Filter event trigger on more than one item

Identity Security Cloud (ISC) ISC Discussion and Questions
1

Is it possible to filter on more than 1 item? For example I want it to trigger if its either 1 access profile out of 2 separate while also checking that the approvalDecision is APPROVED; only triggering when an access request has been approved from either of the two access profiles. I tried this to no success:

$.requestedItemsStatus[?(@.name == "AD-Exchange-Online" || @.name == "AD-Exchange-Onprem" && @.approvalDecision == "APPROVED")]

Works fine without the approvalDecision addition, although we can’t have the workflow trigger on rejected requests.

2

Try this.

$.requestedItemsStatus[?(@.name == "AD-Exchange-Online" || @.name == "AD-Exchange-Onprem")].approvalInfo[?(@.approvalDecision == "APPROVED")]

I used https://www.javainuse.com/jsonpath to test this because it matches very closely to our JSONpath implementation for triggers. The first part of this filter will filter out any requested item that doesn’t match one of those names. Here is the resulting JSON:

$.requestedItemsStatus[?(@.name == "Engineering Access" || @.name == "Engineering Access 2")]

[
	{
		"clientMetadata": {
			"applicationName": "My application"
		},
		"approvalInfo": [
			{
				"approver": {
					"name": "William Wilson",
					"id": "2c91808568c529c60168cca6f90c1313",
					"type": "IDENTITY"
				},
				"approvalDecision": "APPROVED",
				"approvalComment": "This access looks good.  Approved.",
				"approverName": "Stephen.Austin"
			}
		],
		"name": "Engineering Access",
		"description": "Access to engineering database",
		"comment": "William needs this access to do his job.",
		"id": "2c91808b6ef1d43e016efba0ce470904",
		"type": "ACCESS_PROFILE",
		"operation": "Add"
	},
	{
		"clientMetadata": {
			"applicationName": "My application"
		},
		"approvalInfo": [
			{
				"approver": {
					"name": "William Wilson",
					"id": "2c91808568c529c60168cca6f90c1313",
					"type": "IDENTITY"
				},
				"approvalDecision": "REJECTED",
				"approvalComment": "This access looks good.  Approved.",
				"approverName": "Stephen.Austin"
			}
		],
		"name": "Engineering Access 2",
		"description": "Access to engineering database 2",
		"comment": "William needs this access to do his job.",
		"id": "2c91808b6ef1d43e016efba0ce470905",
		"type": "ACCESS_PROFILE",
		"operation": "Add"
	}
]

Then, to filter out the non-approved items, select the approvalInfo object and run another filter:

$.requestedItemsStatus[?(@.name == "Engineering Access" || @.name == "Engineering Access 2")].approvalInfo[?(@.approvalDecision == "APPROVED")]

[
	{
		"approver": {
			"name": "William Wilson",
			"id": "2c91808568c529c60168cca6f90c1313",
			"type": "IDENTITY"
		},
		"approvalDecision": "APPROVED",
		"approvalComment": "This access looks good.  Approved.",
		"approverName": "Stephen.Austin"
	}
]
1 Like
3

Truly appreciate the good and fast answers Colin! You’re the man!

Works perfectly, thank you :slight_smile:

Keep up the good work!

4

A post was split to a new topic: Workflows: check if list is empty

5

Hi, I am after something similar so following up on this thread as I believe the creator might have unwanted behavior if I am not mistaken.

I think there are two cases which are problematic:

  1. In the case that an access profile needed 2 approvals, lets say manager and then App owner and the first person approved and the second one rejected the solution above would still return “true” and trigger the workflow.
  2. If there are no approval needed, in my use case I would still want to trigger this workflow but the suggested filter would return false if approvalInfo is empty.

Therefore I came up with the following filter:

$.requestedItemsStatus[?(@.clientMetadata.requestedAppName== "Test APP" && (@.approvalInfo.length() == 0 || !(@.approvalInfo[?(@.approvalDecision == "REJECTED")] != [])))]

According to https://www.javainuse.com/jsonpath is is an ok filter both syntax and function wise, however when I put this into the worklow it complains about incorrect format.
Any suggestion on what is wrong or how a proper filter would look for my use case?
Perhaps @colin_mckibben has any input? :slight_smile:

Thanks in advance.